On Sept. 20, 2026, Amazon blocked Meta's shopping agent Muse by serving visitors a page that read "Continued access by an unauthorized AI agent violates Amazon's Conditions of Use." Todd Bishop at GeekWire first reported the block that night, with Amazon confirming.

The notice landed twelve days after Meta launched Muse and the same week the Ninth Circuit refused to rehear en banc the Amazon v. Perplexity ruling that had stripped Amazon of its Computer Fraud and Abuse Act leverage against agentic software.

Why Couldn't Amazon Block Muse Through Robots.txt?

Meta's crawler documentation lists five agents and Muse is not among them. Amazon's robots.txt, fetched from amazon.com/robots.txt on Sept. 22, 2026, declares 101 user-agent blocks and names 99 distinct agents, 100 of which carry Disallow: /.

GPTBot, CCBot, PerplexityBot, ClaudeBot, Google-Extended, GoogleAgent-Mariner and GoogleAgent-Shopping are refused everything. Three of Meta's five documented crawlers — meta-externalagent, meta-externalfetcher and meta-webindexer — are listed and refused. Two, FacebookExternalHit and Meta-ExternalAds, are not, so they fall under the general User-agent: * rules.

A block requires a name. Without a documented user-agent string, robots.txt has nothing to match.

What Reasons Did Amazon Give For The Block?

Amazon told GeekWire three things: Meta never told Amazon that Muse would access its store; the agent "doesn't identify itself when it browses"; and it "appears to capture and store customer credentials," which Amazon called a privacy and security risk.

An Amazon spokesperson told GeekWire that third-party applications making purchases on a customer's behalf "should operate openly and respect service provider decisions about whether or not to participate."

Meta had not answered by the time GeekWire published, and no response had appeared in coverage as of Sept. 22.

Why Did Amazon Reach For Terms Of Use Instead Of The CFAA?

The Ninth Circuit ruled on Aug. 4, 2026, that the shopper, not the agent's vendor, is the entity accessing Amazon. The court threw out a March 2026 order against Perplexity's Comet browser, quoting an EFF-led amicus brief: "Perplexity's servers never directly access Amazon's servers."

On Sept. 10, 2026, the circuit refused Amazon's request for rehearing en banc. No judge called for a vote. In that circuit, the CFAA has lost most of its force against human-instigated agent traffic.

Conditions of Use binds the shopper who accepted it when opening an Amazon account. Meta never signed that agreement. The only document Amazon could enforce against a Muse-driven session was the one tying the human to Amazon.

What Did Meta Already Publish About Muse Credentials?

Meta's launch-day post on Sept. 8, 2026 stated that when Muse browses it "will appear as your activity," and that credentials are handled by a background service called authd inside the VM Meta gives each user. Meta's wording: credentials are "stored in your VM, not in centralized Meta infrastructure."

A component called Sentinel, Meta wrote, "will replace any surrogate tokens with the real credential, obtained from authd, at the network boundary." On Meta's description, the model never sees the credentials. No independent audit has been published.

Amazon's "appears to capture and store customer credentials" claim therefore references something Meta had already documented, with the added risk language carrying no request, endpoint or disclosure timeline.

Does Muse Run On Amazon's Own Hardware?

Muse does not run on the shopper's machine. Meta's own description: "you and your Muse share your own dedicated computer in the cloud," an "isolated Linux box" reachable from WhatsApp, the Muse apps and muse.ai. Meta names no hosting provider.

GeekWire notes that Meta signed a multibillion-dollar deal in April 2026 to run agentic AI workloads on Graviton, the server processors Amazon designs for its own cloud. Neither company has said whether Muse is among those workloads.

The Ninth Circuit left one question open in its Aug. 4 opinion: "We do not address whether, on a different record or new facts, Perplexity may exercise control over the Assistant in such a way as to gain entry to Amazon's servers." That reservation points at software-side control — the architecture Muse already uses.

What Should Watchers Monitor Next?

Two pieces of evidence would settle the credential dispute: an independent audit of Muse's VM, or Amazon publishing whatever its "appears to" rests on. Until then, the block is something Amazon did, not a recipe any site can copy.

Watch for a Meta response, a Ninth Circuit clarification on the software-control question, or a move of Muse off Graviton. Watchers should also track whether other retailers write their own "unauthorized AI agent" clauses into shopper-facing terms, and whether Meta adds a Muse user-agent string to its crawler documentation.